Examkin

Design Secure Architectures

438 questions

All types438Multiple choice214Multiple select224
Question 341Question →

A company is deploying a new application on Amazon EC2 instances in a private subnet. The application requires secure read-only access to an Amazon S3 bucket and must retrieve database passwords that are rotated monthly. The development team, who are federated from the company's on-premises Active Directory, also needs administrative access to manage the EC2 instances. The security architect must design a solution that enforces the principle of least privilege, avoids long-term credentials, and prevents credentials from being stored in plaintext. Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Associate an IAM role with the EC2 instances via an instance profile to grant read-only access to the S3 bucket, and store the database passwords in AWS Secrets Manager with automatic rotation enabled.; Configure AWS IAM Identity Center and establish SAML 2.0 federation with the on-premises Active Directory to grant the development team temporary administrative access to the EC2 instances.

Answer

The application should use an IAM role associated via an instance profile to access the S3 bucket, and database passwords should be stored in AWS Secrets Manager with automatic rotation. The development team should access the AWS environment through federation configured with AWS IAM Identity Center.
The correct strategy combines IAM roles on EC2 instances for secure, service-to-service access with AWS Secrets Manager for encrypted, rotated secrets. For human access, federating the existing Active Directory with AWS IAM Identity Center provides short-lived temporary access, eliminating long-term credentials and centralized credential management.

Step-by-Step Solution

1
Address application authorization by creating an IAM role with read-only permissions for the S3 bucket and attaching it to the EC2 instances via an instance profile.
The application on EC2 can securely read from S3 using automatically rotated temporary security credentials.
Eliminates the need for hardcoded, long-term AWS credentials on the EC2 instances.
2
Store the database connection credentials in AWS Secrets Manager, configure automatic rotation with a custom or template-based AWS Lambda function, and grant the EC2 IAM role read permissions to the secret.
The application retrieves the current password securely at runtime, and the password is rotated monthly without developer intervention.
Meets compliance requirements for secure, automated rotation of database credentials without plaintext exposure.
3
Configure AWS IAM Identity Center to federate with the on-premises Active Directory using SAML 2.0 to grant the developers temporary administrative access.
Developers use single sign-on (SSO) to access the AWS Management Console or AWS CLI with short-lived sessions.
Supports the goal of using centralized identity management and avoiding the creation of local IAM users.

Key Concept

Applying least privilege, temporary security credentials via IAM roles/federation, and secure secrets management with automated rotation.
Question 342Question →

A company enables automatic annual key rotation for a customer managed key in AWS Key Management Service (AWS KMS) that is used to encrypt database backups. Which of the following describes how AWS KMS handles the encryption and decryption of existing and new backups after the rotation occurs?

Show answer & explanation

Answer: New backups are encrypted using the new key version, while existing backups remain encrypted under the previous key version, which AWS KMS retains to decrypt them transparently.

Answer

New backups are encrypted using the new key version, while existing backups remain encrypted under the previous key version, which AWS KMS retains to decrypt them transparently.
When automatic key rotation is enabled for a customer managed key, AWS KMS generates a new backing key version every year. The service uses the new key version only for new encryption requests. To ensure that previously encrypted data can still be decrypted, AWS KMS preserves all older versions of the backing key and uses them transparently during decryption requests.

Step-by-Step Solution

1
Understand how AWS KMS Customer Managed Keys rotate.
Enabling automatic rotation creates a new key version (a new backing key) annually.
This limits the amount of data encrypted under a single backing key version.
2
Determine the impact of rotation on existing data (ciphertext).
Existing backups are NOT re-encrypted. AWS KMS retains the previous key versions so they can still be decrypted.
Re-encrypting existing data would be resource-intensive and is not done automatically by AWS KMS.
3
Identify the active key version for new encryption requests.
Only new data is encrypted using the newly active key version.
This meets the key rotation objective of using new keys for new cryptographic operations going forward.

Key Concept

AWS KMS Automatic Key Rotation Mechanics
Question 343Question →

An architect is designing a secure log aggregation solution. A containerized application running on Amazon ECS in Account A must write encrypted JSON log files to an Amazon S3 bucket located in Account B. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) owned by Account B.

The security constraints are:
1. The ECS task role in Account A must be able to encrypt new logs during upload but must be strictly prohibited from decrypting any logs already stored in the S3 bucket.
2. The KMS key must be rotated annually without requiring manual re-encryption of existing logs, and older logs must remain decryptable by authorized security analysts in Account B.

Which configuration meets these requirements with the least privilege?

Show answer & explanation

Answer: Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:DescribeKey operations. Enable automatic key rotation on the CMK in Account B.

Answer

Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:DescribeKey operations, and enable automatic key rotation on the CMK in Account B.
The correct configuration grants the ECS task role in Account A access only to generate the data key (kms:GenerateDataKey) and describe the key (kms:DescribeKey), which allows S3 to encrypt the logs during the upload process. Since kms:Decrypt is not granted, the ECS task cannot read or decrypt the logs. Enabling automatic key rotation on the Customer Managed Key (CMK) rotates the underlying key material annually. AWS KMS automatically preserves previous key versions to decrypt historical data when requested by authorized users, requiring no manual re-encryption or administrative intervention.

Step-by-Step Solution

1
Analyze cross-account write-only encryption requirements.
To upload an object encrypted with SSE-KMS, the S3 service handles the encryption on behalf of the client. The client needs the permission to generate a data key (kms:GenerateDataKey) but does not need the permission to decrypt (kms:Decrypt).
By omitting the kms:Decrypt permission from the ECS task role, we satisfy the constraint that the application must be strictly prohibited from decrypting existing logs.
2
Evaluate KMS automatic key rotation mechanics.
Enabling automatic key rotation on a Customer Managed Key rotates the backing key material annually while keeping the same key ID, metadata, and key policy.
AWS KMS automatically retains all historical backing key versions. When S3 or an authorized user requests decryption of older logs, KMS uses the matching historical key version to decrypt them. No manual re-encryption of existing logs is required, ensuring operational efficiency and data accessibility.
3
Evaluate alternative secret storage and rotation methods.
Using Parameter Store with plaintext parameters is insecure. Creating new keys manually and deleting old ones breaks decryption for historical data.
This confirms that using the native KMS automatic key rotation and the correct IAM permissions is the most secure and compliant design.

Key Concept

Write-only KMS permissions for S3 uploads and KMS automatic key rotation behavior.
Estimated Time:3m 0s
Question 344Question →

A solutions architect is configuring encryption for an Amazon Elastic Block Store (Amazon EBS) volume containing sensitive database backups. The company's security policy requires that the KMS key used for encryption be rotated automatically every year. Which solution meets this requirement with the minimum administrative effort?

Show answer & explanation

Answer: Create a customer managed key in AWS Key Management Service (AWS KMS) and enable automatic key rotation.

Answer

Create a customer managed key in AWS Key Management Service (AWS KMS) and enable automatic key rotation.
The correct option is correct because enabling automatic key rotation on a customer managed key in AWS Key Management Service (AWS KMS) automatically rotates the backing key once per year. The key ID remains the same, and older backing keys are preserved by AWS KMS to decrypt existing data without requiring manual re-encryption or administrative intervention.

Step-by-Step Solution

1
Evaluate the security requirement of automatically rotating encryption keys annually.
Identify that AWS Key Management Service (AWS KMS) provides built-in automatic key rotation capabilities.
AWS KMS is the native service for managing encryption keys used by Amazon EBS.
2
Compare manual key rotation against automatic key rotation for customer managed keys.
Automatic rotation of customer managed keys requires only a single configuration toggle and handles historical data decryption automatically.
This minimizes the administrative overhead requested by the scenario.

Key Concept

AWS KMS Automatic Key Rotation
Question 345Question →

A retail enterprise is establishing a multi-account environment on AWS to support its online commerce platform. The solutions architect needs to set up a governance structure that achieves the following:
1. Enforces centralized user authentication mapped to the company's external corporate identity provider without provisioning static IAM users.
2. Ensures that development and testing accounts cannot launch resources in unauthorized AWS Regions.
3. Prevents member accounts from deleting or modifying Amazon S3 buckets that contain centralized security logs.

Which combination of actions will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate with the external corporate identity provider, mapping corporate groups to permission sets.; Apply Service Control Policies (SCPs) to Organizational Units in AWS Organizations to deny resource creation in unauthorized Regions and protect log-archival Amazon S3 buckets.

Answer

Configure AWS IAM Identity Center to federate with the external corporate identity provider, mapping corporate groups to permission sets, and apply Service Control Policies (SCPs) to Organizational Units in AWS Organizations to deny resource creation in unauthorized Regions and protect log-archival Amazon S3 buckets.
Centralized authentication without static credentials is best achieved by integrating AWS IAM Identity Center with an external IdP. To enforce regional and resource-level constraints across member accounts, Service Control Policies (SCPs) must be applied at the Organizational Unit (OU) level, which ensures guardrails are inherited by the member accounts while keeping the management account clear of policy restrictions.

Step-by-Step Solution

1
Set up identity federation using AWS IAM Identity Center.
Centralized authentication is mapped directly to the corporate identity provider groups without static local credentials.
Meets the requirement for centralized, credentials-free authentication.
2
Create and attach Service Control Policies (SCPs) to the relevant OUs.
Enforces regional restrictions and protects centralized S3 logging buckets across member accounts.
Enforces security guardrails at scale within the organization while ensuring they do not apply to the management account where admin flexibility is required.

Key Concept

Multi-Account Governance and Security Controls

Alternative Method

While AWS Control Tower landing zones could be deployed to establish these guardrails, configuring AWS IAM Identity Center and applying targeted SCPs via AWS Organizations represents the direct architectural mechanism to satisfy these specific compliance requirements.
Estimated Time:1m 30s
Question 346Question →

A gaming analytics platform runs on Amazon EC2 instances in a private VPC subnet (10.10.2.0/2410.10.2.0/24). The instances successfully retrieve session logs from Amazon S3 in the same AWS Region using an S3 Gateway VPC Endpoint. However, when the instances attempt to send batch reports to an external audit API (`https://audit.example.com`) via a NAT Gateway located in a public subnet (10.10.1.0/2410.10.1.0/24), the connections consistently time out.

The private subnet's Network ACL (NACL) is configured as follows:
- Inbound Rule 100: Allow TCP ports 1024−655351024-65535 from 10.10.1.0/2410.10.1.0/24
- Inbound Rule 110: Allow TCP ports 1024−655351024-65535 from the S3 Prefix List (`pl-xxxxxx`)
- Outbound Rule 100: Allow TCP port 443 to 10.10.1.0/2410.10.1.0/24
- Outbound Rule 110: Allow TCP port 443 to the S3 Prefix List (`pl-xxxxxx`)
- Default rule: Deny all other traffic

The EC2 instances are associated with a Security Group that has the following rules:
- Inbound: Allow TCP port 443 from 10.10.1.0/2410.10.1.0/24
- Outbound: Allow TCP port 443 to 0.0.0.0/00.0.0.0/0

Which of the following configurations will resolve the timeout issue while maintaining the principle of least privilege?

Show answer & explanation

Answer: Modify the private subnet's Network ACL to allow outbound TCP port 443 to 0.0.0.0/00.0.0.0/0 and inbound TCP ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.

Answer

Modify the private subnet's Network ACL to allow outbound TCP port 443 to 0.0.0.0/00.0.0.0/0 and inbound TCP ports 1024−655351024-65535 from 0.0.0.0/00.0.0.0/0.
The correct option correctly identifies that Network ACLs (NACLs) are stateless and inspect the actual source and destination IP addresses in the packet headers. When EC2 instances in the private subnet send packets to the external API, the destination IP remains the API's public IP address (not the NAT Gateway's IP). Consequently, the outbound NACL must allow traffic to 0.0.0.0/00.0.0.0/0 on TCP port 443. Similarly, when the return traffic arrives, the source IP is the API's public IP, and the destination port is the ephemeral port (1024−655351024-65535) allocated by the EC2 instance. Therefore, the inbound NACL must allow traffic from 0.0.0.0/00.0.0.0/0 on ports 1024−655351024-65535. Security Groups are stateful and automatically permit return traffic, so no changes to the Security Group are needed.

Step-by-Step Solution

1
Analyze how packets are routed and formatted when sent from private EC2 instances to an external public IP via a NAT Gateway.
The routing table forwards packets to the NAT Gateway ENI, but the destination IP in the packet's IP header remains the public IP of `audit.example.com`, not the NAT Gateway's IP.
Understanding that network routing does not rewrite the destination IP address of outbound packets at the subnet boundary.
2
Evaluate the stateless Network ACL (NACL) behavior for outbound traffic.
Since the destination IP is a public address, the packet does not match the local public subnet CIDR (10.10.1.0/2410.10.1.0/24). The outbound NACL blocks the packet because there is no rule allowing TCP port 443 to 0.0.0.0/00.0.0.0/0.
Network ACLs are stateless and must explicitly allow the outbound destination IP address.
3
Evaluate the stateless NACL behavior for inbound return traffic.
Return packets from the external API arrive via the NAT Gateway. The source IP in the packet header is the public IP of the external API, and the destination port is an ephemeral port (1024−655351024-65535). The inbound NACL blocks this return traffic because it only allows ephemeral ports from the public subnet CIDR, not from 0.0.0.0/00.0.0.0/0.
Since NACLs are stateless, return traffic must be explicitly allowed inbound based on the original source IP and ephemeral destination port.
4
Verify Security Group requirements.
Security groups are stateful. The outbound rule allows TCP port 443 to 0.0.0.0/00.0.0.0/0, which matches both the S3 endpoint and the public API. No inbound security group rules are required because return traffic is automatically allowed.
Confirming that the stateful firewall layer is already correctly configured and does not block the return traffic.

Key Concept

Stateless Network ACLs evaluate IP headers based on original source and destination IPs, which are preserved across NAT Gateway routing. Ephemeral ports must be allowed in the return direction.
Estimated Time:3m 0s
Question 347Question →

A company is deploying an application that requires access to a database password. The company's security policy mandates that this database password must be encrypted at rest and automatically rotated every 30 days. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager.; Enable automatic rotation in AWS Secrets Manager and configure an AWS Lambda function to update the database credentials.

Answer

The database password must be stored in AWS Secrets Manager, with automatic rotation enabled using an AWS Lambda function.
AWS Secrets Manager provides built-in encryption at rest and integrates with AWS Lambda to automatically rotate database credentials on a schedule.

Step-by-Step Solution

1
Select the storage service that supports secret rotation.
AWS Secrets Manager is chosen.
Systems Manager Parameter Store lacks a native automated rotation mechanism.
2
Implement the rotation logic.
An AWS Lambda function is configured to update the secret and the target database.
Secrets Manager uses Lambda to securely rotate database credentials.

Key Concept

Credential Storage and Automated Rotation in AWS
Question 348Question →

A company's security team wants to delegate the creation and management of IAM roles for microservices to development team leads in several member accounts within an AWS Organization. However, the security team must ensure that team leads cannot create roles or modify policies that allow access to a centralized audit Amazon S3 bucket. Which solution should the security team implement to meet these requirements?

Show answer & explanation

Answer: Configure an IAM permissions boundary that denies access to the centralized audit S3 bucket, and require the team leads to apply this boundary when creating any new IAM roles.

Answer

Configure an IAM permissions boundary that denies access to the centralized audit S3 bucket, and require the team leads to apply this boundary when creating any new IAM roles.
The correct solution uses an IAM permissions boundary. A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity. When you delegate IAM role creation to a user or role, you can enforce that they can only create roles with a specific permissions boundary attached. This prevents the delegated administrator from creating roles that have more permissions than allowed, protecting resources like the central audit S3 bucket.

Step-by-Step Solution

1
Analyze the requirement to delegate IAM role creation to team leads while preventing them from granting access to a specific S3 bucket.
Identify that the team leads need permissions to create IAM roles, but must be restricted from escalating privileges beyond a certain limit.
This establishes the need for a mechanism that sets the maximum permissions an IAM entity can delegate.
2
Evaluate AWS IAM features designed for delegating administration with permission limits.
Identify IAM permissions boundaries as the native feature that controls the maximum permissions an IAM policy can grant to a principal or role.
Permissions boundaries ensure that even if a team lead creates a role with AdministratorAccess, that role's effective permissions are limited by the boundary.
3
Formulate a policy that denies access to the centralized audit S3 bucket and use it as the permissions boundary.
A boundary policy is created and enforced via an IAM policy on the team leads, requiring them to attach the boundary to any roles they create.
This meets the security requirement with the least operational overhead and aligns with AWS best practices.

Key Concept

IAM Permissions Boundaries
Estimated Time:1m 30s
Question 349Question →

A financial institution processes transactions in Account A using Amazon EC2 instances with encrypted Amazon EBS volumes. The volumes are encrypted using an AWS KMS customer managed key (CMK) for which the security team has enabled automatic annual key rotation. The compliance policy requires the institution to share periodic EBS snapshots with an external auditing firm operating in Account B. The auditing firm must restore these snapshots to EC2 instances in Account B. Additionally, the auditing application requires a database API key to write audit logs to a database in Account B. Which combination of actions will securely meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account A, modify the key policy of the KMS customer managed key to grant Account B's IAM role permissions to perform kms:Decrypt, kms:DescribeKey, and kms:CreateGrant operations.; Rely on AWS KMS automatic key rotation to automatically retain older key versions, allowing Account B to decrypt and restore snapshots that were encrypted before the rotation occurred.

Answer

Modifying the KMS key policy in Account A to allow Account B to decrypt and create grants, and relying on AWS KMS automatic key rotation to automatically retain older key versions for decrypting historical snapshots.
The correct solution involves modifying the KMS key policy in Account A to permit Account B's IAM role to decrypt the snapshots and create grants for the EC2 service in Account B. It also relies on AWS KMS automatic key rotation, which automatically preserves historical key versions to decrypt snapshots that were encrypted before the rotation occurred. This ensures continuous access without administrative overhead or security compromises.

Step-by-Step Solution

1
Evaluate key sharing capability based on key type
Identify that AWS managed keys cannot be shared cross-account, which confirms a Customer Managed Key (CMK) must be used in Account A.
AWS managed keys are bound to a single account and their policies cannot be customized for cross-account delegation.
2
Determine the required KMS key policy permissions for EBS snapshot sharing
Grant Account B permissions for kms:Decrypt, kms:DescribeKey, and kms:CreateGrant in the Account A CMK key policy.
The EC2 service in Account B needs kms:Decrypt to read the snapshot data and kms:CreateGrant to delegate key usage to the EC2 service-linked role for attaching the volume.
3
Analyze the impact of KMS key rotation on historical snapshots
Determine that automatic key rotation preserves previous key versions to decrypt older snapshots, making manual re-encryption unnecessary.
AWS KMS manages key version history automatically, mapping the ciphertext to the correct historical key version during decryption.
4
Determine the secure method for database API key storage
Reject plaintext String parameter storage in favor of SecureString or Secrets Manager.
Storing credentials in plaintext is a security risk and violates compliance policies.

Key Concept

Cross-account KMS key sharing, EBS snapshot restoration permissions, KMS key rotation mechanics, and secure secret storage.
Estimated Time:3m 0s
Question 350Question →

A company uses an AWS Key Management Service (AWS KMS) customer managed key to encrypt data in an Amazon S3 bucket. The security team enables automatic annual key rotation for this key. What will happen to the existing data that was encrypted before the key rotation occurred?

Show answer & explanation

Answer: The existing data remains encrypted under the older key version, and AWS KMS automatically uses the older key version to decrypt the data when requested.

Answer

The existing data remains encrypted under the older key version, and AWS KMS automatically uses the older key version to decrypt the data when requested.
When automatic key rotation is enabled for a customer managed key, AWS KMS retains all prior versions of the backing key. This allows AWS KMS to decrypt existing data encrypted with older key versions automatically without requiring any actions from the user or applications.

Step-by-Step Solution

1
Identify the mechanism of AWS KMS automatic key rotation for customer managed keys.
Rotation generates new backing key material for new encryption requests while keeping historical backing key material active.
This allows new data to be encrypted with the new key version while old data remains decryptable.
2
Analyze the impact of key rotation on existing data in Amazon S3.
Determine that existing S3 objects remain encrypted with the key version that was active when they were written.
AWS KMS preserves older backing keys to ensure seamless decryption of historical data.
3
Select the option that correctly describes the automatic retention and usage of historical keys.
Recognize that AWS KMS automatically resolves which backing key version is needed to decrypt the older S3 objects, requiring no manual intervention or re-encryption.
This aligns with AWS best practices for secure and operational efficiency in key management.

Key Concept

AWS KMS automatic key rotation mechanics and preservation of historical key material
Question 351Question →

A company is deploying a secure processing application on Amazon EC2 instances in a private subnet (Subnet A: 10.0.1.0/2410.0.1.0/24). The EC2 instances must receive HTTPS requests on port 443443 from an internal Application Load Balancer (ALB) located in another private subnet (Subnet B: 10.0.2.0/2410.0.2.0/24). Additionally, the EC2 instances must securely retrieve configuration files from an Amazon S3 bucket. The company's security policy mandates that Subnet A must use a custom Network ACL (NACL) configured with a default-deny posture to block all unspecified traffic, and no traffic is allowed to transit the internet. Currently, a Gateway VPC Endpoint is used for Amazon S3, but the EC2 instances cannot connect to S3, and the ALB health checks are failing.

Which TWO actions should a solutions architect take to resolve these connectivity issues while complying with the security policy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet (10.0.2.0/2410.0.2.0/24) on port 443443, and allow outbound traffic to the ALB subnet (10.0.2.0/2410.0.2.0/24) on ephemeral ports (1024−655351024-65535).; Replace the S3 Gateway VPC Endpoint with an Interface VPC Endpoint for Amazon S3, and configure the Network ACL of Subnet A to allow outbound traffic to the private IP addresses of the interface endpoint on port 443443, and inbound traffic from those private IP addresses on ephemeral ports (1024−655351024-65535).

Answer

Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet on port 443443 and outbound traffic on ephemeral ports, and replace the S3 Gateway VPC Endpoint with an Interface VPC Endpoint while allowing traffic to its private IP addresses.
The correct configuration requires addressing two separate network flows under a stateless network security model. First, for the ALB communication, because Network ACLs are stateless, allowing inbound traffic on port 443443 from the ALB subnet must be paired with allowing outbound return traffic on the ephemeral port range (1024−655351024-65535) back to the ALB subnet. Second, for the S3 communication, Gateway VPC Endpoints utilize public IP addresses and routing tables, which would require opening the Network ACL to broad public ranges or a wildcard (0.0.0.0/00.0.0.0/0). By replacing it with an Interface VPC Endpoint, S3 traffic uses private IP addresses, enabling the Network ACL to restrict outbound traffic to those specific private IPs on port 443443 and inbound return traffic on ephemeral ports, adhering to the company's strict security requirements.

Step-by-Step Solution

1
Analyze the stateless behavior of Network ACLs (NACLs) for the ALB traffic.
Since NACLs are stateless, they evaluate traffic in both directions independently. To allow inbound HTTPS requests from the ALB on port 443443, the NACL must allow inbound port 443443 from the ALB subnet and outbound ephemeral ports (1024−655351024-65535) to the ALB subnet for the return traffic.
Health checks and client requests from the ALB will fail if the stateless NACL blocks the return traffic.
2
Evaluate the limitations of Gateway VPC Endpoints with custom default-deny NACLs.
Gateway Endpoints route traffic to S3's public IP addresses. NACLs do not support S3 prefix lists, meaning the NACL would require allowing outbound traffic to 0.0.0.0/00.0.0.0/0 on port 443443 and inbound return traffic on ephemeral ports. This violates the security policy that prohibits internet-bound routes.
NACL rules only accept CIDR blocks, not logical constructs like AWS prefix lists.
3
Determine the secure alternative for S3 connectivity.
By using an Interface VPC Endpoint (powered by AWS PrivateLink) for S3, the endpoint is assigned private IP addresses from the VPC. The NACL can then be configured with highly restrictive rules allowing outbound HTTPS traffic only to these specific private IP addresses.
This maintains the strict default-deny and no-internet-transit policies while restoring S3 connectivity.

Key Concept

Stateless Network ACL configuration requires managing return traffic explicitly, and Interface Endpoints allow private IP-based NACL filtering unlike Gateway Endpoints.
Estimated Time:3m 0s
Question 352Question →

An e-learning company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application needs protection from SQL injection attacks and volumetric Layer 3 and Layer 4 DDoS attacks. The company wants a solution that requires minimal operational overhead and integrates with their current architecture.

Which solution should a solutions architect recommend to meet these requirements?

Show answer & explanation

Answer: Deploy Amazon CloudFront in front of the Application Load Balancer, associate AWS WAF with the CloudFront distribution to block SQL injection using managed rules, and rely on AWS Shield Standard for automatic Layer 3 and Layer 4 DDoS protection.

Answer

Deploy Amazon CloudFront in front of the Application Load Balancer, associate AWS WAF with the CloudFront distribution to block SQL injection using managed rules, and rely on AWS Shield Standard for automatic Layer 3 and Layer 4 DDoS protection.
Deploying Amazon CloudFront with an associated AWS WAF web ACL uses managed rules to inspect HTTP payloads at the edge and mitigate Layer 7 SQL injection attacks. AWS Shield Standard, which is automatically active for CloudFront, provides Layer 3 and Layer 4 DDoS protection with zero configuration or additional cost.

Step-by-Step Solution

1
Analyze security requirements at different network layers.
Identify that SQL injection is a Layer 7 application exploit, whereas volumetric DDoS attacks target Layers 3 and 4.
Choosing the correct security tools requires mapping the threat type to the OSI model layer.
2
Select the appropriate services to inspect application traffic and mitigate DDoS.
AWS WAF provides Layer 7 payload inspection, and AWS Shield Standard provides automatic Layer 3/4 protection at the edge when integrated with Amazon CloudFront.
AWS WAF handles web application firewall duties, and AWS Shield Standard handles edge DDoS mitigation, providing a complete security posture.
3
Integrate the edge security components with the load-balanced application.
Deploy Amazon CloudFront as the entry point in front of the Application Load Balancer, then attach AWS WAF to the CloudFront distribution.
Moving threat mitigation to the edge with CloudFront reduces load on origin EC2 instances and mitigates attacks before they reach the VPC.

Key Concept

Edge security and DDoS protection using AWS Shield and AWS WAF
Estimated Time:1m 30s
Question 353Question →

A global logistics company hosts its shipment-tracking application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent downtime due to sophisticated Layer 7 HTTP flood attacks originating from a distributed botnet. The company needs to implement a solution that mitigates these HTTP floods at the network edge, minimizes latency for global users, and prevents unauthorized requests from bypassing the edge security controls.

Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an Amazon CloudFront distribution in front of the Application Load Balancer, and associate an AWS WAF web ACL containing a rate-based rule with the distribution.; Configure the Application Load Balancer's security group to restrict inbound traffic to only the Amazon CloudFront IP ranges using the AWS-managed prefix list.

Answer

Deploying an Amazon CloudFront distribution with an AWS WAF web ACL rate-based rule, and restricting the Application Load Balancer security group to CloudFront IP addresses using the AWS-managed prefix list.
To protect the application from Layer 7 HTTP floods at the edge and minimize latency, deploying Amazon CloudFront and associating an AWS WAF web ACL with a rate-based rule is the recommended AWS best practice. The rate-based rule monitors client requests and automatically blocks IPs that exceed the set threshold. Furthermore, to prevent attackers from bypassing these edge controls and attacking the backend directly, the Application Load Balancer's security group must be locked down to only allow inbound traffic from the CloudFront IP ranges, which is easily managed using the AWS-managed prefix list.

Step-by-Step Solution

1
Analyze the attack vector and mitigation point.
The attack is a Layer 7 HTTP flood. The requirement is to mitigate this at the network edge and minimize latency for global users.
Layer 7 attacks must be mitigated using application-aware firewalls. Edge services like Amazon CloudFront and AWS WAF are best suited to inspect and block traffic globally before it reaches the backend.
2
Select edge security components.
Deploy Amazon CloudFront to cache content and reduce latency, and associate an AWS WAF web ACL with a rate-based rule to automatically block HTTP floods.
AWS WAF rate-based rules track the request rate from client IP addresses and temporarily block IPs that exceed the threshold, protecting against distributed L7 attacks at the edge.
3
Secure the origin backend.
Restrict access to the Application Load Balancer by configuring its security group to only allow traffic from CloudFront.
If the Application Load Balancer is publicly accessible, attackers can bypass CloudFront and AWS WAF entirely. Restricting the ALB security group using the AWS-managed prefix list for CloudFront ensures all traffic is forced through the edge security layer.

Key Concept

Mitigating Layer 7 HTTP flood attacks at the edge using CloudFront and AWS WAF, and securing the backend origin ALB from direct access.
Estimated Time:2m 0s
Question 354Question →

A company is designing a secure web application that stores session logs in Amazon S3 and uses a database. The database credentials must be encrypted and rotated periodically. The session logs must be encrypted using a customer managed key in AWS KMS, and the security team requires that the KMS key be automatically rotated annually without requiring existing logs to be re-encrypted. Which of the following configurations should a solutions architect recommend to meet these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable automatic key rotation for the AWS KMS customer managed key, which creates a new backing key version annually while keeping the previous versions for decrypting older data.; Store the database credentials in AWS Secrets Manager and configure a rotation schedule using a built-in or custom AWS Lambda function.

Answer

Enable automatic key rotation for the AWS KMS customer managed key, and store the database credentials in AWS Secrets Manager with an automated rotation schedule.
Enabling automatic key rotation for the KMS key generates a new backing key annually while retaining the old backing keys. This allows the application to read old data without any code changes or manual re-encryption. AWS Secrets Manager is the standard service for storing and rotating database credentials securely using Lambda.

Step-by-Step Solution

1
Select a secure storage service for the database credentials that supports automatic rotation.
AWS Secrets Manager is selected because it natively supports rotating secrets using AWS Lambda.
Storing passwords in plain text in Parameter Store is insecure, making Secrets Manager the ideal choice for credentials.
2
Configure AWS KMS key rotation for encrypting S3 session logs.
Enable AWS KMS automatic key rotation.
Automatic key rotation creates a new backing key version annually and retains old versions, which automatically decrypts historical data without re-encryption.

Key Concept

Key rotation and secure secret management are fundamental to AWS data encryption. AWS KMS automatic rotation handles backing key versions transparently, while AWS Secrets Manager secures and rotates database credentials using Lambda.
Question 355Question →

An organization stores highly confidential regulatory reports in an Amazon S3 bucket. The security policy mandates that these reports must be encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The policy also dictates that the encryption key must be rotated every 90 days, and any reports older than one year must be re-encrypted using the most recent key material to ensure that historical key versions can eventually be retired. Which combination of actions will meet these security requirements with the least operational overhead?

Show answer & explanation

Answer: Enable automatic key rotation on the CMK and set the rotation period to 90 days. Run an Amazon S3 Batch Operations job with a Copy operation targeting objects older than one year, specifying the same CMK ARN as the encryption key.

Answer

Enable automatic key rotation on the CMK and set the rotation period to 90 days, then use Amazon S3 Batch Operations with a Copy operation to re-encrypt objects older than one year under the same CMK ARN.
The correct option addresses all compliance requirements with minimal operational overhead. Since May 2024, AWS KMS Customer Managed Keys support custom automatic key rotation periods between 90 and 730 days, satisfying the 90-day rotation requirement natively. Because automatic rotation does not retroactively re-encrypt existing objects, an in-place S3 Batch Operations Copy job targeting objects older than one year is the standard best practice to force S3 to request a new data key (which will be generated from the newly rotated backing key material) and re-encrypt the data.

Step-by-Step Solution

1
Configure the AWS KMS Customer Managed Key (CMK) for automatic rotation.
Automatic rotation is enabled, and the rotation period is set to 90 days using the custom rotation period capability of CMKs.
This meets the compliance requirement of rotating the key material every 90 days with zero operational overhead for key generation.
2
Identify objects older than one year that need to be re-encrypted.
An S3 Inventory list or custom filter identifies objects that have a creation date older than 365 days.
This defines the target dataset that must be re-encrypted to phase out the older key material.
3
Execute an S3 Batch Operations Copy job on the target objects using the same CMK ARN.
The objects are copied to themselves (in-place copy). S3 requests a new data key from KMS to write the copied object, which is generated using the newly rotated active key version.
This forces the re-encryption of the historical data under the latest key version, allowing the old backing key versions to eventually be retired without modifying the S3 bucket's configuration or changing object URLs.

Key Concept

AWS KMS Customer Managed Key custom rotation periods and Amazon S3 Batch Operations for data re-encryption.
Question 356Question →

An enterprise is securing a payment processing application running on Amazon EC2 instances in a private subnet (CIDR 10.0.1.0/2410.0.1.0/24). The application must securely access Amazon S3 to read transaction logs and connect to an external credit bureau API via HTTPS over the internet. Currently, all outbound traffic from the private subnet is routed through a NAT Gateway located in a public subnet. To optimize cost and security, the solution architect deploys a Gateway VPC Endpoint for Amazon S3. The architect now wants to restrict network access at both the subnet and instance levels to allow only these two destinations, adhering to the principle of least privilege. Which of the following configurations must the architect implement to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a route to the private subnet's route table that targets the S3 Gateway VPC Endpoint for the destination Amazon S3 prefix list, while keeping the default route (0.0.0.0/00.0.0.0/0) targeting the NAT Gateway.; Configure the security group associated with the EC2 instances to allow outbound traffic to the Amazon S3 prefix list on port 443443, and outbound traffic to the credit bureau's public IP range on port 443443.

Answer

To secure the architecture, the private subnet's route table must route S3 prefix list traffic through the S3 Gateway VPC Endpoint while retaining the default route to the NAT Gateway, and the EC2 instances' security group must outbound-allow HTTPS traffic to both the S3 prefix list and the credit bureau's IP range.
The correct configuration combines route table updates and stateful security group rules. The route table must have a route pointing the S3 prefix list to the S3 Gateway VPC Endpoint, while the default route remains pointed at the NAT Gateway for the credit bureau API. The instances' security groups should restrict outbound HTTPS traffic to the S3 prefix list and the credit bureau's IP range. Because security groups are stateful, return traffic is permitted automatically.

Step-by-Step Solution

1
Configure the route table for the private subnet.
Add a route with the S3 prefix list as the destination and the Gateway VPC Endpoint ID as the target. Maintain the default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway.
Gateway VPC Endpoints require route table entries mapped to the S3 prefix list. Other internet traffic (the credit bureau API) must continue using the NAT Gateway.
2
Configure security groups at the instance level.
Add two outbound rules: one allowing TCP port 443443 to the S3 prefix list, and another allowing TCP port 443443 to the credit bureau's CIDR.
Security groups are stateful, allowing return traffic automatically. They support referencing prefix lists and CIDR blocks to enforce least-privilege egress filtering.
3
Evaluate subnet-level Network ACL restrictions.
Keep the Network ACL rules configured with standard IP CIDRs and ephemeral ports if restricting at this layer, avoiding attempts to reference prefix lists or VPC endpoint IDs.
Network ACLs do not support AWS-specific resources like prefix lists or VPC endpoint IDs, so security group filtering is preferred for granular resource-level restriction.

Key Concept

Gateway VPC Endpoint routing and the operational limits of stateless Network ACLs vs stateful Security Groups.
Question 357Question →

A developer is hosting a web application on a single Amazon EC2 instance. The developer wants to allow external users to access the application over HTTPS while blocking all other incoming traffic. To achieve this, which configuration should be applied to the security group associated with the EC2 instance?

Show answer & explanation

Answer: Add an inbound rule allowing TCP port 443443 from source 0.0.0.0/00.0.0.0/0.

Answer

Add an inbound rule allowing TCP port 443443 from source 0.0.0.0/00.0.0.0/0.
The correct option is the one that recommends adding an inbound rule allowing TCP port 443443 from source 0.0.0.0/00.0.0.0/0. Since security groups are stateful firewalls, they automatically allow return traffic for established connections. Therefore, allowing inbound TCP port 443443 is sufficient to enable external users to establish HTTPS connections and receive responses.

Step-by-Step Solution

1
Identify the resource security requirement.
The requirement is to allow external users to access an application hosted on an EC2 instance over HTTPS (TCP port 443443) while blocking all other traffic.
This establishes that we need to configure traffic rules at the host/instance level using security groups.
2
Determine the stateful behavior of the security group.
Security groups are stateful, meaning any allowed inbound traffic is automatically allowed to exit, and any allowed outbound traffic is automatically allowed to enter.
Understanding statefulness simplifies the rules needed, indicating that we do not need to configure corresponding outbound rules for return traffic.
3
Formulate the correct inbound rule.
Create an inbound rule allowing TCP port 443443 from the internet (0.0.0.0/00.0.0.0/0) to the EC2 instance.
This allows external users to initiate HTTPS requests while the security group's default deny-all behavior blocks other unspecified ports.

Key Concept

Stateful behavior of AWS Security Groups
Estimated Time:45s
Question 358Question →

A company is setting up a new multi-account AWS environment. The security team wants to establish a secure administrative access strategy for its systems administrators and migrate database credentials currently hardcoded in application configuration files. The solution must enforce the principle of least privilege, eliminate long-term credentials for daily management, and automatically rotate database passwords. Which TWO options should the solutions architect recommend to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure AWS IAM Identity Center to federate access from the company's identity provider and assign administrative roles using permission sets.; Use AWS Secrets Manager to store the database credentials and enable automatic rotation.

Answer

To secure administrative access and database credentials, the company must implement federated access using AWS IAM Identity Center and store the database credentials in AWS Secrets Manager with automatic rotation enabled.
Implementing federated access through AWS IAM Identity Center ensures that systems administrators use short-term credentials, fulfilling the security requirement to eliminate long-term keys. Storing credentials in AWS Secrets Manager allows the organization to systematically rotate the database passwords automatically without code changes.

Step-by-Step Solution

1
Federate administrative access.
By using AWS IAM Identity Center mapped to the corporate identity provider, administrators obtain temporary security credentials instead of relying on long-term keys.
This minimizes the credential exposure window and satisfies the requirement to eliminate long-term access keys.
2
Secure database passwords and configure lifecycles.
Moving hardcoded database passwords to AWS Secrets Manager protects them at rest and in transit.
Secrets Manager provides native capabilities to automatically rotate these passwords at scheduled intervals, satisfying compliance requirements.

Key Concept

Federated identity management and automated secrets lifecycle rotation under least privilege principles.
Question 359Question →

An operations team is setting up a deployment pipeline and needs to store a sensitive API token that Amazon ECS tasks will use to access a third-party service. The solutions architect decides to store the token in AWS Systems Manager Parameter Store. Which configuration should the solutions architect choose to store and protect the token?

Show answer & explanation

Answer: Create a Parameter Store parameter using the SecureString type, which encrypts the token using an AWS Key Management Service (AWS KMS) key.

Answer

Create a Parameter Store parameter using the SecureString type, which encrypts the token using an AWS Key Management Service (AWS KMS) key.
The correct option is to use a SecureString parameter in Systems Manager Parameter Store. This configuration automatically encrypts the sensitive API token at rest using an AWS KMS key. This prevents unauthorized users from viewing the credentials in plaintext and adheres to AWS security best practices.

Step-by-Step Solution

1
Identify the security requirement for the sensitive API token.
The API token is sensitive credential data that must be encrypted at rest.
Storing credentials in plaintext poses a security risk.
2
Evaluate Systems Manager Parameter Store parameter types.
The String type stores values in plaintext, while the SecureString type encrypts values using AWS KMS.
SecureString is the correct parameter type for sensitive data.
3
Determine the impact of KMS key rotation on stored secrets.
Rotating a KMS key generates a new backing key for new encryption requests, but does not re-encrypt existing ciphertext or affect plaintext parameters.
Understanding key rotation mechanics ensures correct architectural assumptions.

Key Concept

Using Systems Manager Parameter Store SecureString parameters encrypted with AWS KMS to securely store sensitive configuration data.
Question 360Question →

An application hosted on Amazon EC2 instances in a private subnet (Subnet A: 10.0.1.0/2410.0.1.0/24) of a VPC must securely access AWS Key Management Service (AWS KMS) to decrypt sensitive transactional payloads. Compliance policies dictate that all traffic must remain within the AWS network, and no NAT Gateways or Internet Gateways are allowed. A solutions architect deploys an Interface VPC Endpoint for AWS KMS in a separate private subnet (Subnet B: 10.0.2.0/2410.0.2.0/24). Both subnets are associated with custom Network Access Control Lists (NACL A and NACL B) that currently deny all traffic. To achieve this secure communication while adhering to the principle of least privilege, which combination of Security Group and Network ACL rules is required?

Show answer & explanation

Answer: EC2 Security Group allows outbound TCP 443443 to the KMS Endpoint Security Group. KMS Endpoint Security Group allows inbound TCP 443443 from the EC2 Security Group. NACL A allows outbound TCP 443443 to 10.0.2.0/2410.0.2.0/24 and inbound TCP 10241024-6553565535 from 10.0.2.0/2410.0.2.0/24. NACL B allows inbound TCP 443443 from 10.0.1.0/2410.0.1.0/24 and outbound TCP 10241024-6553565535 to 10.0.1.0/2410.0.1.0/24.

Answer

Configure the EC2 Security Group to allow outbound TCP 443443 to the KMS Endpoint Security Group, and the KMS Endpoint Security Group to allow inbound TCP 443443 from the EC2 Security Group. Configure NACL A to allow outbound TCP 443443 to 10.0.2.0/2410.0.2.0/24 and inbound TCP 10241024-6553565535 from 10.0.2.0/2410.0.2.0/24. Configure NACL B to allow inbound TCP 443443 from 10.0.1.0/2410.0.1.0/24 and outbound TCP 10241024-6553565535 to 10.0.1.0/2410.0.1.0/24.
The correct option correctly accounts for the stateful nature of Security Groups and the stateless nature of Network ACLs. Security Groups only require rules allowing the flow in the direction of connection establishment (outbound TCP 443443 on the client side, inbound TCP 443443 on the server side). Network ACLs require explicit rules for both the initial outbound request (to destination port 443443) and the corresponding inbound return packet (to destination ephemeral ports 10241024-6553565535) on the client subnet, and vice versa on the server subnet.

Step-by-Step Solution

1
Determine Security Group configurations based on their stateful nature.
EC2 instances initiate traffic to the KMS endpoint on port 443443. Because Security Groups are stateful, the EC2 SG only needs an outbound rule to the KMS SG, and the KMS SG only needs an inbound rule from the EC2 SG. Return traffic is automatically tracked and allowed.
Security Groups track connections and allow response traffic to flow back without needing explicit reverse rules.
2
Analyze the client-server interaction to identify ports for the stateless Network ACL rules.
The client (EC2 in Subnet A) sends traffic from an ephemeral source port (range 10241024-6553565535) to the server (KMS Endpoint in Subnet B) on destination port 443443. The return traffic flows from source port 443443 to the destination ephemeral port.
Stateless Network ACLs evaluate inbound and outbound packets independently and require rules for both request and response paths.
3
Define rules for NACL A (Subnet A).
Outbound rule: Allow TCP destination port 443443 to Subnet B (10.0.2.0/2410.0.2.0/24). Inbound rule: Allow TCP destination ports 10241024-6553565535 (ephemeral range) from Subnet B (10.0.2.0/2410.0.2.0/24).
NACL A must allow the outgoing requests to reach the endpoint subnet and allow the returning server responses back into the subnet.
4
Define rules for NACL B (Subnet B).
Inbound rule: Allow TCP destination port 443443 from Subnet A (10.0.1.0/2410.0.1.0/24). Outbound rule: Allow TCP destination ports 10241024-6553565535 (ephemeral range) to Subnet A (10.0.1.0/2410.0.1.0/24).
NACL B must allow the incoming requests to reach the KMS endpoint and allow the outgoing responses to return to the EC2 instances.

Key Concept

Stateless Network ACLs vs Stateful Security Groups
Estimated Time:3m 0s
PreviousPage 18 / 22Next
Design Secure Architectures Practice Questions — AWS Certified Solutions Architect - Associate — Page 18 | Examkin